P90, P50, P10
Another approach to using multiple point estimation involves using probabilities which do not add up to 100%. We might for example, say that an arson attack on your office is 90% likely (Probability = 90% or ‘P90’) to be put out quickly by the state of the art fire suppression system with a loss of less than $100,000.
There might, hypothetically, be a 50% chance (P50) that the fire could cause $2million damage, but it would be very unlikely (P10) to cause a catastrophic loss with costs of $20 million. This would be expressed as “If there is an arson attack” the likely consequences are:
P90 - $100,000
P50 - $2,000,000
P10 - $20,000,000
This system isn’t designed to be mathematically accurate but is useful for discussing the likelihood of various consequences with stakeholders, to establish range estimates. It might also be expressed in terms of ‘almost certain’, ‘possible’, and ‘very unlikely’. You might for example, based on past years, consider your likely expected loss (EL) for annual theft as being:
P90 (almost certain) to lose $50,000 = 0.90 * $50,000 = $45,000 EL
P50 (credible scenario) a loss of $150,000 = 0.50 * $150,000 = $75,000 EL
P10 (worst case but unlikely) loss of $1,000,000 = 0.10 * $1,000,000 = $100,000 EL
With discussion, you might expand this to:
Plotted on a chart, you can see the range of expected likely outcomes. If there is a successful arson attack, the chance of a loss in excess of $200,000 is close to zero.